ARP侦查工具Netdiscover

Netdiscover是一个主动/被动的ARP侦查工具。该工具在不使用DHCP的无线网络上非常有用。使用Netdiscover工具可以在网络上扫描IP地址，ARP侦查工具Netdiscover检查在线主机或搜索为它们发送的ARP请求。下面将介绍Netdiscover工具的使用方法。本文选自Kail Linux渗透测试实训手册大学霸

首先查看下Netdiscover工具的帮助信息，执行命令如下所示：

• root :~# netdiscover -h

• Netdiscover 0.3-beta7 [Active/passive arp reconnaissance tool]

• Written by: Jaime Penalba <jpenalbae@gmail.com>

• Usage: netdiscover [-i device] [-r range | -l file | -p] [-s time] [-n node] [-c count] [-f] [-d] [-S] [-P] [-C]

•   -i device: your network device

•   -r range: scan a given range instead of auto scan. 192.168.6.0/24,/16,/8

•   -l file: scan the list of ranges contained into the given file

•   -p passive mode: do not send anything, only sniff

•   -F filter: Customize pcap filter expression (default: "arp")

•   -s time: time to sleep between each arp request (miliseconds)

•   -n node: last ip octet used for scanning (from 2 to 253)

•   -c count: number of times to send each arp reques (for nets with packet loss)

•   -f enable fastmode scan, saves a lot of time, recommended for auto

•   -d ignore home config files for autoscan and fast mode

•   -S enable sleep time supression betwen each request (hardcore mode)

•  �-P print results in a format suitable for parsing by another program

•   -L in parsable output mode (-P), continue listening after the active scan is completed

• If -r, -l or -p are not enabled, netdiscover will scan for common lan addresses.

输出的信息显示了Netdiscover的语法格式及可用的参数本文选自Kail Linux渗透测试实训手册大学霸。

【实例3-3】使用Netdiscover工具扫描局域网中所有的主机ARP侦查工具Netdiscover。执行命令如下所示：

• root :~# netdiscover

执行以上命令后，将显示如下所示的信息：

• Currently scanning: 10.7.99.0/8   |   Screen View: Unique Hosts              

•                                                                               

•  692 Captured ARP Req/Rep packets, from 3 hosts.   Total size: 41520           

•  _____________________________________________________________________________

•    IP            At MAC Address      Count  Len   MAC Vendor                  

•  -------------------------------------------------------------------------------------------------------------------------------

•  192.168.6.102   00:e0:1c:3c:18:79    296    17760   Cradlepoint, Inc         

•  192.168.6.1     14:e6:e4:ac:fb:20    387     23220   Unknown vendor           

•  192.168.6.110   00:0c:29:2e:2b:02    09      540     VMware, Inc.

从输出的信息中，可以看到扫描到三台主机本文选自Kail Linux渗透测试实训手册大学霸ARP侦查工具Netdiscover。